{"api_version":"1","generated_at":"2026-10-24T14:05:29+00:00","cve":"CVE-2026-99005","urls":{"html":"https://cve.report/CVE-2026-99005","api":"https://cve.report/api/cve/CVE-2026-99005.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-99005","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-99005"},"summary":{"title":"drm/i915/gt: Unmask interrupts only when ACTIVE is true","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Unmask interrupts only when ACTIVE is true\n\nThere is a small race window between intel_rps_boost() reading\na stale ACTIVE state and queuing rps->work, where ACTIVE may be\nchanged via asynchronous calls triggered by wakeref drop.\nThis means that rps_work() could be triggered after the GT has\nbeen parked, so unmasking RPS PM interrupts would happen without\nholding PM wakelock. This sequence of events may be observed\nduring live_rc6_ctx_wa() selftest:\n\n1) live_rc6_ctx_wa()\n   -> intel_engine_pm_put()\n      -> wakeref_put()\n\nASYNC1) wakeref_put() callback\n          -> __engine_park()\n             -> intel_gt_pm_put_async()\n                -> intel_gt_pm_put_async_untracked()\n                   -> intel_wakeref_put_async()\n\nASYNC2) wakeref_put_async() callback\n          -> __gt_park()\n             -> intel_rps_park()\n                -> intel_rps_clear_active() [clear ACTIVE]\n                WITH INTERRUPTS:\n                -> rps_disable_interrupts()\n                   -> cancel_work_sync(rps->work)\n                   -> rps_reset_interrupts() [rps->pm_iir = 0]\n                WITHOUT INTERRUPTS (TIMER mode):\n                -> rps_stop_timer()\n                   -> cancel_work_sync(rps->work)\n\n2) live_rc6_ctx_wa()\n   -> intel_gt_wait_for_idle()\n      -> intel_gt_retire_requests_timeout()\n         -> dma_fence_wait_timeout()\n            -> ops->wait() [i915_fence_wait()]\n               -> i915_request_wait_timeout()\n                  -> intel_rps_boost()\n                     -> intel_rps_is_active() [check ACTIVE]\n                        [OPEN RACE WINDOW]\n                     -> queue_work(rps->work)\n         -> retire_requests()\n            -> i915_request_retire()\n               -> intel_rps_dec_waiters() [from 1 to 0]\n\nIf ASYNC1 and ASYNC2 would execute during [OPEN RACE WINDOW],\nthen:\n\n3) rps_work() executes from the workqueue and may satisfy\n   \"(!pm_iir && !client_boost)\" test (in TIMER mode rps->pm_iir\n   is zeroed by an earlier rps_work() call or never gets a new\n   value after previous intel_rps_unpark() event), so it jumps\n   to \"out\" label, bypassing intel_rps_is_active() guard and\n   executes gen6_gt_pm_unmask_irq();\n\n4) GT is parked and runtime PM wakelock is dropped, so only\n   a raw reference in __gt_park() ->\n   intel_display_power_put_async() remains for 100ms, then the\n   MMIO write in gen6_gt_pm_unmask_irq() detects missing\n   wakelock via assert_rpm_wakelock_held() and emits\n   \"RPM wakelock ref not held during HW access\" tainting kernel.\n\nCommit 3e7abf814193 (\"drm/i915: Extract GT render power state management\")\ndropped the \"if (rps->interrupts_enabled)\" guard that\ngen6_pm_rps_work() had around this unmask in i915_irq.c.\nINTEL_RPS_ACTIVE brackets the same window, since it is set in\nintel_rps_unpark() before rps_enable_interrupts() and\nrps_start_timer() and cleared in intel_rps_park() before\nrps_stop_timer() and rps_disable_interrupts().\n\nSkip unmasking when RPS is no longer active (reaching unmask\noperation is independent of INTERRUPT mode). This does not\nprevent RPS operation from resuming on the next unpark.\nIn interrupt mode, intel_rps_unpark() calls\nrps_enable_interrupts(), which enables and unmasks the PM\ninterrupts. In timer mode, it calls rps_start_timer(),\nrestarting periodic engine-busyness evaluation. The timer\ngenerates software RPS events and queues rps_work() directly,\nindependently of PM interrupt delivery. Neither mode requires\nthe late worker to unmask interrupts while the GT is parked\n\n(cherry picked from commit ca4a6deadad15b91ee083afe445fa6bdbfb68206)","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-23 13:17:22","updated_at":"2026-10-23 13:17:22"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/77abc1837c9651c8f43f7f7f336d10093eeb7745","name":"https://git.kernel.org/stable/c/77abc1837c9651c8f43f7f7f336d10093eeb7745","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/0b4a0fb98b9ffeac36798bbd369c821605cae70f","name":"https://git.kernel.org/stable/c/0b4a0fb98b9ffeac36798bbd369c821605cae70f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/60f58da15f8c8e39706c564f9251de3626636dce","name":"https://git.kernel.org/stable/c/60f58da15f8c8e39706c564f9251de3626636dce","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb","name":"https://git.kernel.org/stable/c/5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/49d349c42cf5ebaa878d02699c632c9d883d935f","name":"https://git.kernel.org/stable/c/49d349c42cf5ebaa878d02699c632c9d883d935f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-99005","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99005","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3e7abf8141935ded77abeb622480bf4a14241ece 77abc1837c9651c8f43f7f7f336d10093eeb7745 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3e7abf8141935ded77abeb622480bf4a14241ece 60f58da15f8c8e39706c564f9251de3626636dce git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3e7abf8141935ded77abeb622480bf4a14241ece 0b4a0fb98b9ffeac36798bbd369c821605cae70f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3e7abf8141935ded77abeb622480bf4a14241ece 49d349c42cf5ebaa878d02699c632c9d883d935f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3e7abf8141935ded77abeb622480bf4a14241ece 5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.5","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.5 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.160 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.113 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.57 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.11 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/i915/gt/intel_rps.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"77abc1837c9651c8f43f7f7f336d10093eeb7745","status":"affected","version":"3e7abf8141935ded77abeb622480bf4a14241ece","versionType":"git"},{"lessThan":"60f58da15f8c8e39706c564f9251de3626636dce","status":"affected","version":"3e7abf8141935ded77abeb622480bf4a14241ece","versionType":"git"},{"lessThan":"0b4a0fb98b9ffeac36798bbd369c821605cae70f","status":"affected","version":"3e7abf8141935ded77abeb622480bf4a14241ece","versionType":"git"},{"lessThan":"49d349c42cf5ebaa878d02699c632c9d883d935f","status":"affected","version":"3e7abf8141935ded77abeb622480bf4a14241ece","versionType":"git"},{"lessThan":"5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb","status":"affected","version":"3e7abf8141935ded77abeb622480bf4a14241ece","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/i915/gt/intel_rps.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.5"},{"lessThan":"5.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.113","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.57","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.160","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.113","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.57","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.11","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"5.5","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Unmask interrupts only when ACTIVE is true\n\nThere is a small race window between intel_rps_boost() reading\na stale ACTIVE state and queuing rps->work, where ACTIVE may be\nchanged via asynchronous calls triggered by wakeref drop.\nThis means that rps_work() could be triggered after the GT has\nbeen parked, so unmasking RPS PM interrupts would happen without\nholding PM wakelock. This sequence of events may be observed\nduring live_rc6_ctx_wa() selftest:\n\n1) live_rc6_ctx_wa()\n   -> intel_engine_pm_put()\n      -> wakeref_put()\n\nASYNC1) wakeref_put() callback\n          -> __engine_park()\n             -> intel_gt_pm_put_async()\n                -> intel_gt_pm_put_async_untracked()\n                   -> intel_wakeref_put_async()\n\nASYNC2) wakeref_put_async() callback\n          -> __gt_park()\n             -> intel_rps_park()\n                -> intel_rps_clear_active() [clear ACTIVE]\n                WITH INTERRUPTS:\n                -> rps_disable_interrupts()\n                   -> cancel_work_sync(rps->work)\n                   -> rps_reset_interrupts() [rps->pm_iir = 0]\n                WITHOUT INTERRUPTS (TIMER mode):\n                -> rps_stop_timer()\n                   -> cancel_work_sync(rps->work)\n\n2) live_rc6_ctx_wa()\n   -> intel_gt_wait_for_idle()\n      -> intel_gt_retire_requests_timeout()\n         -> dma_fence_wait_timeout()\n            -> ops->wait() [i915_fence_wait()]\n               -> i915_request_wait_timeout()\n                  -> intel_rps_boost()\n                     -> intel_rps_is_active() [check ACTIVE]\n                        [OPEN RACE WINDOW]\n                     -> queue_work(rps->work)\n         -> retire_requests()\n            -> i915_request_retire()\n               -> intel_rps_dec_waiters() [from 1 to 0]\n\nIf ASYNC1 and ASYNC2 would execute during [OPEN RACE WINDOW],\nthen:\n\n3) rps_work() executes from the workqueue and may satisfy\n   \"(!pm_iir && !client_boost)\" test (in TIMER mode rps->pm_iir\n   is zeroed by an earlier rps_work() call or never gets a new\n   value after previous intel_rps_unpark() event), so it jumps\n   to \"out\" label, bypassing intel_rps_is_active() guard and\n   executes gen6_gt_pm_unmask_irq();\n\n4) GT is parked and runtime PM wakelock is dropped, so only\n   a raw reference in __gt_park() ->\n   intel_display_power_put_async() remains for 100ms, then the\n   MMIO write in gen6_gt_pm_unmask_irq() detects missing\n   wakelock via assert_rpm_wakelock_held() and emits\n   \"RPM wakelock ref not held during HW access\" tainting kernel.\n\nCommit 3e7abf814193 (\"drm/i915: Extract GT render power state management\")\ndropped the \"if (rps->interrupts_enabled)\" guard that\ngen6_pm_rps_work() had around this unmask in i915_irq.c.\nINTEL_RPS_ACTIVE brackets the same window, since it is set in\nintel_rps_unpark() before rps_enable_interrupts() and\nrps_start_timer() and cleared in intel_rps_park() before\nrps_stop_timer() and rps_disable_interrupts().\n\nSkip unmasking when RPS is no longer active (reaching unmask\noperation is independent of INTERRUPT mode). This does not\nprevent RPS operation from resuming on the next unpark.\nIn interrupt mode, intel_rps_unpark() calls\nrps_enable_interrupts(), which enables and unmasks the PM\ninterrupts. In timer mode, it calls rps_start_timer(),\nrestarting periodic engine-busyness evaluation. The timer\ngenerates software RPS events and queues rps_work() directly,\nindependently of PM interrupt delivery. Neither mode requires\nthe late worker to unmask interrupts while the GT is parked\n\n(cherry picked from commit ca4a6deadad15b91ee083afe445fa6bdbfb68206)"}],"providerMetadata":{"dateUpdated":"2026-10-23T12:20:30.462Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/77abc1837c9651c8f43f7f7f336d10093eeb7745"},{"url":"https://git.kernel.org/stable/c/60f58da15f8c8e39706c564f9251de3626636dce"},{"url":"https://git.kernel.org/stable/c/0b4a0fb98b9ffeac36798bbd369c821605cae70f"},{"url":"https://git.kernel.org/stable/c/49d349c42cf5ebaa878d02699c632c9d883d935f"},{"url":"https://git.kernel.org/stable/c/5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb"}],"title":"drm/i915/gt: Unmask interrupts only when ACTIVE is true","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-99005","datePublished":"2026-10-23T12:20:30.462Z","dateReserved":"2026-09-25T10:25:14.385Z","dateUpdated":"2026-10-23T12:20:30.462Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-23 13:17:22","lastModifiedDate":"2026-10-23 13:17:22","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"99005","Ordinal":"1","Title":"drm/i915/gt: Unmask interrupts only when ACTIVE is true","CVE":"CVE-2026-99005","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"99005","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Unmask interrupts only when ACTIVE is true\n\nThere is a small race window between intel_rps_boost() reading\na stale ACTIVE state and queuing rps->work, where ACTIVE may be\nchanged via asynchronous calls triggered by wakeref drop.\nThis means that rps_work() could be triggered after the GT has\nbeen parked, so unmasking RPS PM interrupts would happen without\nholding PM wakelock. This sequence of events may be observed\nduring live_rc6_ctx_wa() selftest:\n\n1) live_rc6_ctx_wa()\n   -> intel_engine_pm_put()\n      -> wakeref_put()\n\nASYNC1) wakeref_put() callback\n          -> __engine_park()\n             -> intel_gt_pm_put_async()\n                -> intel_gt_pm_put_async_untracked()\n                   -> intel_wakeref_put_async()\n\nASYNC2) wakeref_put_async() callback\n          -> __gt_park()\n             -> intel_rps_park()\n                -> intel_rps_clear_active() [clear ACTIVE]\n                WITH INTERRUPTS:\n                -> rps_disable_interrupts()\n                   -> cancel_work_sync(rps->work)\n                   -> rps_reset_interrupts() [rps->pm_iir = 0]\n                WITHOUT INTERRUPTS (TIMER mode):\n                -> rps_stop_timer()\n                   -> cancel_work_sync(rps->work)\n\n2) live_rc6_ctx_wa()\n   -> intel_gt_wait_for_idle()\n      -> intel_gt_retire_requests_timeout()\n         -> dma_fence_wait_timeout()\n            -> ops->wait() [i915_fence_wait()]\n               -> i915_request_wait_timeout()\n                  -> intel_rps_boost()\n                     -> intel_rps_is_active() [check ACTIVE]\n                        [OPEN RACE WINDOW]\n                     -> queue_work(rps->work)\n         -> retire_requests()\n            -> i915_request_retire()\n               -> intel_rps_dec_waiters() [from 1 to 0]\n\nIf ASYNC1 and ASYNC2 would execute during [OPEN RACE WINDOW],\nthen:\n\n3) rps_work() executes from the workqueue and may satisfy\n   \"(!pm_iir && !client_boost)\" test (in TIMER mode rps->pm_iir\n   is zeroed by an earlier rps_work() call or never gets a new\n   value after previous intel_rps_unpark() event), so it jumps\n   to \"out\" label, bypassing intel_rps_is_active() guard and\n   executes gen6_gt_pm_unmask_irq();\n\n4) GT is parked and runtime PM wakelock is dropped, so only\n   a raw reference in __gt_park() ->\n   intel_display_power_put_async() remains for 100ms, then the\n   MMIO write in gen6_gt_pm_unmask_irq() detects missing\n   wakelock via assert_rpm_wakelock_held() and emits\n   \"RPM wakelock ref not held during HW access\" tainting kernel.\n\nCommit 3e7abf814193 (\"drm/i915: Extract GT render power state management\")\ndropped the \"if (rps->interrupts_enabled)\" guard that\ngen6_pm_rps_work() had around this unmask in i915_irq.c.\nINTEL_RPS_ACTIVE brackets the same window, since it is set in\nintel_rps_unpark() before rps_enable_interrupts() and\nrps_start_timer() and cleared in intel_rps_park() before\nrps_stop_timer() and rps_disable_interrupts().\n\nSkip unmasking when RPS is no longer active (reaching unmask\noperation is independent of INTERRUPT mode). This does not\nprevent RPS operation from resuming on the next unpark.\nIn interrupt mode, intel_rps_unpark() calls\nrps_enable_interrupts(), which enables and unmasks the PM\ninterrupts. In timer mode, it calls rps_start_timer(),\nrestarting periodic engine-busyness evaluation. The timer\ngenerates software RPS events and queues rps_work() directly,\nindependently of PM interrupt delivery. Neither mode requires\nthe late worker to unmask interrupts while the GT is parked\n\n(cherry picked from commit ca4a6deadad15b91ee083afe445fa6bdbfb68206)","Type":"Description","Title":"drm/i915/gt: Unmask interrupts only when ACTIVE is true"}]}}}